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© Method for testing a protocol, and system for applying the method. 

© The testing of a protocol (such as the generation of all possible permutations) is a simple matter if the 
protocol shows completely deterministic or completely non-deterministic behaviour. If the protocol shows a 
combined behaviour, the test is often based on an inefficient "trial and error" method, whose completeness, 
moreover, is not verifiable. The invention provides a method which, based on two submethods, tests the protocol 
in an efficient manner (one for determining whether an event is permitted to occur and one for forming 
sequences of allowed events, the one regularly consulting the other). 
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A Background to the invention 

The invention relates to a method for testing a protocol in which events occur which have defined 
relationships with one another. A method of this type is generally known. If the protocol shows completely 
deterministic behaviour (which means that all possible sequential orders of events which may occur are 
predictable), the testing of the protocol comprises the generation, on the basis of all predictable possible 
sequential orders, of sequences of allowed successive events. If the protocol shows completely non- 
deterministic behaviour, testing of the protocol comprises the writing out, in a simple manner, of the 
completely non-deterministic behaviour (for example by writing out in terms of all permutations in protocol 
behaviour) and the subsequent generation, on the basis of all possible sequential orders, of sequences of 
allowed successive events. . 

A protocol which shows both deterministic and non-deterministic behaviour is considerably less simple 
to tost in particular as the number of events which may occur increases and as the complexity of the 
relationships between these events increases. Known methods, for protocols like these, use so-called "trial 
and error" methods which are of course time-consuming and thus not very efficient, and whose complete- 
ness, moreover, cannot be verified. 

B Summary of the invention 

The object of the invention is, inter alia, to provide a method of the type mentioned in the preamble, 
which tests protocols efficiently, independent of the fact whether these show completely deterministic, 
completely non-deterministic or both deterministic and non-deterministic behaviour. 

To this end. the method according to the invention is characterised in that 

- the method comprises a first submethod for determining whether an event y is permitted to occur by 

- checking, if a further event x has not occurred, whether a relationship between the event x and the 
event y implies that the event y is not permitted to occur before the event x has occurred, in which 
case the combination is not allowed, 

- checking, if a further event x has occurred, whether a relationship between the event x and the 
event y implies that the event y is not permitted to occur after the event x has occurred and 
whether a relationship between the event y and the event x implies that the event x is not 
permitted to precede the event y, in which cases the combination is not allowed, 

- establishing, in all other cases, that the combination is allowed and repeating the first submethod in 
order to determine whether the event y is permitted to occur in combination with another further 

event, . , 

• the method comprises a second submethod for finding a subsequent allowed event q in the case or 

an event p by . 

- defining the event p as being an event which has occurred and appending it to a sequence ot 

allowed events which have occurred, 

- repeating, if the event q has already occurred, the second submethod in order to find another 
40 subsequent allowed event, 

- checking, if the event q has not occurred, by applying the first submethod whether the event q is 
permitted to occur in combination with the event p, and by 

- appending, in the case of an allowed combination, the event q to a sequence of allowed events 
which have occurred and repeating the second submethod in order to find a subsequent allowed 

4 5 event in the case of the event q, 

- repeating, in the case of a non-allowed combination, the second submethod in order to find 
another subsequent allowed event in the case of the event p, and 

- redefining the event p as being an event which has not occurred and removing it from the sequence 
of allowed events which have occurred, 
so - the method finds all possible sequences of allowed events by 

- applying the first submethod to every possible first event, and 

- applying the second submethod to all possible first events found. 
The invention is based on the inventive insight that the method can be split into two submethods: the 

first for determining whether an event is permitted to occur, and the second for forming sequences of 
allowed vents, the first submethod b ing consulted regularly, which second method is moreover of 
recursive type. 

Th first submethod is used to p rform a check whether the event y is permitted to occur, given the 
further event x which has not yet occurred or indeed has already occurred: if the event x has not yet 
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occurred, a check is performed whether a relationship between the event x and the event y implies that the 
event y is not permitted to occur before the event x has occurred, and if the event x has indeed already 
occurred, a check is performed whether a relationship between the event x and the event y implies that the 
event y is not permitted to occur after the event x has occurred and whether a relationship between the 

5 event y and the event x implies that the event x is not permitted to have preceded the event y. In all these 
cases, the combination is not allowed, and in all other cases the combination is indeed allowed and this first 
* submethod is repeated for another further event. 

The second submethod is used to search for the next allowed event q in the case of the event p, which 
at the start of the second submethod is defined as being an event which has occurred and is appended to a 

w sequence of allowed events which have occurred: if the event q has already occurred, the second 
submethod is repeated in order to find another subsequent allowed event, and if the event q has not yet 
occurred, a check is performed on the basis of the first submethod whether the event q is permitted to 
occur given the event p, in the case of an allowed combination the event q being appended to a sequence 
of allowed events which have occurred and the second submethod being repeated in order to find a 

75 subsequent allowed event in the case of the event q (recursivity), and, in the case of a non-allowed 
combination, the second submethod being repeated in order to find another subsequent allowed event in 
the case of the event p. The second submethod terminates with the redefinition of the event p as being an 
event which has not occurred and the removal of the event p from the sequence of allowed events which 
have occurred. 

20 The method according to the invention finds all the possible sequences of allowed events by applying 
the first submethod to every possible first event (a check, therefore, being performed whether the event y is 
permitted to occur given, successively, all the other events which have not yet occurred, in which case the 
event y is a possible first event found) and by applying the second submethod to all possible first events 
found. 

25 In a first embodiment, the method according to the invention is characterised in that the method 
comprises a third submethod for determining whether a sequence of allowed events is complete, a 
condition specifying, of each event, whether the occurrence of this event is or is not mandatory, by 

- checking, if an arbitrarily chosen event v has not occurred, whether a condition relating to the event v 
implies that the event v must occur, in which case the sequence is not complete, and in the other - 

30 case, if the arbitrarily chosen event v has not occurred, by 

- checking, if a further event w has not occurred, whether a relationship between the event v and the 
event w and a relationship between the event w and the event v imply that at least one of the two 
events v and w must occur, in which case the sequence is not complete, 

- checking, if the further event w has occurred, whether a relationship between the event v and the 
35 event w and a relationship between the event w and the event v imply that, if the event w has 

occurred, the event v must occur likewise, in which case the sequence is not complete, and 

- repeating the third submethod with another further event, and 

- repeating, if the arbitrarily chosen event v has occurred, the third submethod with another arbitrarily 
chosen event in order to determine whether a sequence of allowed events is complete. 

40 The third submethod is used to perform a check whether a sequence of allowed events is complete. In 
doing so it is necessary for a condition of each event to specify whether the occurrence of said event is or . 
is not mandatory. If an arbitrarily chosen event v has not occurred, a check is carried out whether a 
condition relating to the event v implies that the event v must occur, in which case the sequence is not 
complete, a check being carried out in the other case, if a further event w has not occurred, whether a 

45 relationship between the event v and the event w and a relationship between the event w and the event v 
imply that at least one of the two events v and w must occur, in which case the sequence is not complete, a 
check being carried out, if the further event w has occurred, whether a relationship between the event v and 
the event w and a relationship between the event w and the event v imply that, if the event w has occurred, 
the event v must occur likewise, in which case the sequence is not complete, and in all other cases the 

so third submethod being repeated with another further event, and if the arbitrarily chosen event v has indeed 
occurred, the third submethod is repeated with another arbitrarily chosen event in order to determine 
whether a sequence of allowed events is complete. 

The third submethod can therefore be used to determine whether a sequence is complete. 
The invention further r lates to a system for applying the method. 

55 A further object of th inv ntion is, inter alia, to provid a system of the abovementioned type, which 
tests protocols ffici ntly, independent of th fact whether these show completely deterministic, completely 
non-deterministic or both det rministic and non-deterministic b haviour. 
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To this end, the system according to the invention is characterised in that the system is provided with 
means for storing 

- at least one event code which is representative for an event which may occur, 

- at least one status code which is representative for a status of ttiis event, 

5 - at least one relationship code which is representative for a relationship between this event and another 
event, and 

- at least one combination code which is representative for the allowedness of a combination of events, 
in which the system, for determining whether an event y is permitted to occur, is designed for an analysis 
of a first type by 

w - disallowing, in the case of a status code related to a further event x in one sense and a relationship 
code related to the events x and y of a first type, the combination and assigning a negative 
combination code, 

- disallowing, in the case of a status code related to a further event x in another sense and a 
relationship code related to the events x and y of a second type and a relationship code related to the 

>5 events y and x of a third type, the combination and assigning a negative combination code, 

- allowing, in all other cases, the combination and assigning a positive combination code and repeating 
the analysis of a first type for determining whether the event y is permitted to occur in combination 
with another further event, 

in which the system, for finding a subsequent allowed event q in the case of an event p. is designed for an 
20 analysis of a second type by 

- assigning a status code in another sense to the event p and appending the event p to a sequence of 
allowed events which have occurred, 

- repeating, in the case of a status code in another sense related to event q, the analysis of a second 
type for finding another subsequent allowed event, 

25 - performing, in the case of a status code in one sense related to event q. an analysis of a first type for 
determining whether the event q is permitted to occur in combination with the event p and by 
- appending, in the case of a positive combination code, the event q to a sequence of allowed 
events which have occurred and performing an analysis of a second type for finding a subsequent 
allowed event in the case of the event q, and 
30 - performing, in the case of a negative combination code, an analysis of a second type for finding 

another subsequent allowed event in the case of the event p, 

- assigning a status code in one sense to the event p and removing the event p from a sequence of 
allowed events which have occurred, 

in which the system, for finding all possible sequences of allowed events, is designed for 
35 - performing an analysis of a first type for every possible first event, 

- performing an analysis of a second type for all possible first events found. 

In this context, event codes each represent an event which may occur, and status codes each represent 
the status of such an event (a status code in one sense corresponds, for example, to non-occurrence so far, 
and a status code in another sense corresponds to earlier occurrence of the event). Furthermore, 
40 ; relationship codes each represent a relationship between an event and another event (a relationship code of 
the first type relating to a relationship between the event x and the event y corresponds, for example, to the 
event y not being permitted to occur before the event x has occurred, a relationship code of the second 
type relating to a relationship between the event x and the event y corresponds, for example, to the event y 
not being permitted to occur after the event x has occurred, and a relationship code of the third type 
45 . relating to a relationship between the event y and the event x corresponds, for example, to the event x not 
being permitted to precede the event y) and combination codes each represent the allowedness or non- 
allowedness of a combination of events (a positive combination code corresponds, for example, to the 
allowedness of a combination, and a negative combination code to the non-allowedness). The analysis of a 
first type in this context in fact relates to the first submethod, and the analysis of a second type then relates 
so to the second submethod). 

In a first embodiment, the system according to the invention is characterised in that the system is 
provided with means for storing at least one occurrence code which is representative for the mandatory 
occurrence of an event, which system, for determining whether a sequence of allowed events is complete, 
is designed for an analysis of a third type by 
55 - establishing, in the case of a status code, related to an arbitrarily chosen event v, in one sense and a 
positive occurr nee code related to the arbitrarily chosen event v, that a sequence is incomplete and 
by, in the case of a negative occurrence code related to the arbitrarily chosen event v and of a status 
code, related to the arbitrarily chosen event v, in one sense 
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- establishing, in the case of a status code, related to a further event w. in one sense and a 
relationship code, related to the events v and w, of a fourth type and a relationship code, related to 
the events w and v, of a fifth type, that a sequence is incomplete, 

- establishing, in the case of a status code, related to a further event w, in another sense and a 
5 itHatiunship code, related to the events v and w, of a sixth type and a relationship code, related to 

the events w and v. of a seventh type, that a sequence is incomplete, and 

- subsequently performing an analysis of a third type with another further event w, and 

- performing, in the case of a status code, related to an arbitrarily chosen event v, in another sense, an 
analysts of a third type with another arbitrarily chosen event to determine whether a sequence of 
w allowed events is complete. 

In this context, occurrence codes each represent a condition defining whether the occurrence of an 
event is mandatory or not (a positive occurrence code corresponds, for example, to the event being 
required to occur and a negative occurrence code to the event not absolutely being required to occur). 
Furthermore, the relationship codes each represent the relationship between an event and another event (a 
J5 relationship code of the fourth type relating to a relationship between the event v and the event w and a 
relationship code of the fifth type relating to a relationship between the event w and the event v correspond, 
for example, to at least one of the events v and w being required to occur, a relationship code of the sixth 
type relating to a relationship between the event v and the event w and a relationship code of the seventh 
type relating to a relationship between the event w and the event v correspond, for example, to the event v 
20 being required to occur if the event w has already occurred). The analysis of a third type in this context in 
fact relates to the third submethod. 

C Reference 

25 ■ 

D Illustrative embodiment 

The invention will be explained in more detail with reference to an illustrative embodiment depicted in 
30 the figures, in which: 

Figure 1 shows a flow chart of the first submethod of the method according to the invention, 
Figure 2 shows a flow chart of the second submethod of the method according to the invention, 
Figure 3 shows a flow chart of the method according to the invention, and 

Figure 4 shows a flow chart of the third submethod of an embodiment of the method according to the 
35 invention. 

In the flow chart depicted in Figure 1, the boxes have the following meaning: 
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meaning 

the first submethod is applied to an event y in order to 
determine whether the event y is permitted to occur 

is there no further event x not equal to the event y left 
in store? 

if yes: goto box 3 
if no: goto box 4 

the first submethod is terminated positively 
an event x still in store is selected 
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has this event x occurred? 
if yes: goto box 8 
if no: goto box 6 

does a relationship between the event x and the event 
y imply that the event y is not permitted to occur 
before the event x has occurred? 
if yes: goto box 1 3 
if no: goto box 7 

the event y is permitted to occur before the event x, 
goto box 2 

does a relationship between the event x and the event 
y imply that the event y is not permitted to occur after 
the event x has occurred? 
if yes: goto box 1 2 
if no: goto box 9 

does a relationship between the event y and the event 

x imply that the event x is not permitted to precede 

the event y? 

if yes: goto box 1 1 

if no: goto box 10 

the event y is permitted to occur after the event x, 
goto box 2 
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the event x is not permitted to precede the event y, 



goto box 1 4 
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the event y is not permitted to occur after the event x, 



10 



goto box 1 4 



13 



the event y is not permitted to occur before the event 



x ( goto box 14 



20 



14 



the first submethod is terminated negatively 



The first submethod of the method according to the invention as depicted in the flow chart of Figure 1 
proceeds as follows. When it is applied to the event y (box 1} a check is first carried out whether there is no 

25 further event x not equal to the event y left in store (box 2). If that is so, the first submethod is terminated 
positively (box 3) which means that the event y is permitted to occur. If there is at least one further event x 
in store, such an event x is chosen (box 4), whereafter a check is carried out whether this event x has 
occurred (box 5). If the event x has occurred, a check is carried out whether a relationship between the 
event x and the event y implies that the event y is not permitted to occur after the event x has occurred 

30 (box 8), in which case it is found that the event y is not permitted to occur after the event x (box 12) and the 
first submethod is terminated negatively (box 14). This means that the event y is not permitted to occur. In 
the other case, a check is carried out whether a relationship between the event y and the event x implies 
that the event x is not permitted to precede the event y (box 9), in which case it is found that the event x is 
not permitted to precede the event y (box 11) and the first submethod is terminated negatively (box 14). In 

35 the other case it is found that the event y is permitted to occur after the event x (box 10), whereupon a 
check is again carried out whether no further event x not equal to the event y is left in store (box 2), etc. If 
the event x has not occurred, a check is carried out whether a relationship between the event x and the 
event y implies that the event y is not permitted to occur before the event x has occurred (box 6), in which 
case it is found that the event y is not permitted to occur before the event x (box 13) and the first 

40 submethod is terminated negatively (box 14). In the other case it is found that the event y is permitted to 
occur before the event x (box 7), whereupon a check is again carried out whether no further event x not 
equal to the event y is left in store (box 2), etc. 

In the flow chart depicted in Figure 2, the boxes have the following meaning: 
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meaning 

the second submethod is applied to an event p in order 
to find a subsequent allowed event q in the case of the 
event p 

the event p is defined as an event which has occurred 
and is appended to a sequence of allowed events 
which have occurred 

is there is no event q which has not yet occurred and 
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is not equal to the event p left in store? 
if yes: goto box 23 

5 

if no: goto box 24 

«> 23 the event p is redefined as an event which has not 

occurred, and is removed from a sequence of allowed 
events which have occurred, and the second 

75 

submethod is terminated 
20 24 an event q still in store is selected 

2g 25 the first submethod is applied with y = q 

26 is the event q allowed? 

30 

if yes: goto box 27 
if no: goto box 22 



35 



40 



27 the second submethod is applied to the event q in 

order to find a subsequent allowed event in the case of 
the event q 



The second submethod of the method according to the invention as depicted in the flow chart of Figure 
45 2 proceeds as follows. When it is applied to the event p (box 20), the event p is first defined as an event 
' which has occurred and is appended to a sequence of allowed events which have occurred (box 21). A 
check is then carried out whether there is no event q which has not yet occurred and which is not equal to 
the event p left in store (box 22). If this is so, the event p is redefined as an event which has not occurred 
and is removed from a sequence of allowed events which have occurred, and the second submethod is 
so terminated (box 23), which means that no subsequent allowed event q in the case of event p has been 
found. If there is at least one event q which has not occurred and which is not equal to the event p left in 
store, this event q still in store is selected (box 24). and the first submethod depicted by means of the flow 
chart' of Figure 1 is applied to the event q (ie. y = q, box 25). Using this procedure thus determines 
whether the event q is permitted to occur or not, given the event p which has already occurred (and 
55 possible v nts which have occurr d arlier and which already form an allowed combination with the event 
p, as a result of the recursivity of the s cond submethod), in other words whether the sequence (terminating 
with) p,q is a sequence of allowed ev nts. If the event q is not allowed, a check is again carried out whether 
there is no vent q which has not y t occurred and which is not equal to th event p left in store (box 22), 
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and if th event q is indeed allowed, the second submethod is applied to the event q in order to find a 
subsequent allowed event in the cas of the event q (this thus shows the recursivity of the second 
submethod). Thus the second submethod is used to find all possible subsequent allowed events q in the 
case of the event p, and thus all the sequences of allowed events are therefore completed which start with 
5 or (as a result of the recursivity) are continued with the event p. 

In the flow chart depicted in Figure 3, the boxes have the following meaning: 



box 


meaning 


30 


the method according to the invention is applied 


31 


each event is defined as an event which has not 
occurred 


32 


is there no event left in store? 
if yes: goto box 33 
if no: goto box 34 


33 


the method according to the invention is terminated 


34 


the first submethod is applied to an event which has 
not yet occurred 


35 


is this event not permitted to occur as a first event? 
if yes: goto box 32 
if no: goto box 36 


36 


the second submethod is applied to said first event, 
goto box 32 



The method according to the invention (box 30) as depicted in the flow chart of Figure 3 proceeds as 
follows. Each event is defined as an event which has not occurred (box 31). A check is then carried out 
whether there is no event left in store (box 32). If this is so, the method according to the invention is 
terminated (box 33), and if this is not so, an event which has not yet occurred is selected, and the first 
submethod is applied to said chosen event which has not yet occurred (box 34). By applying the first 
submethod it is then determined whether this event which has not yet occurred is or is not permitted to 
occur as a first event of a sequence of events. If this is not permitted, a check is again carried out whether 
there is no event which has not yet occurred left in store (box 32), etc. If the event which has not yet 
occurred is permitted to occur as a first event, the second submethod is applied to said first event (box 36), 
by means of which then all sequences of allowed events starting with said first event are found. A check is 
then again carried out whether there is no event which has not yet occurred left in store (box 32), etc. 
Ultimately, all the sequences of allowed events will be found by means of the method according to the 
invention. 

In the flow chart depicted in Figure 4, the boxes have the following meaning: 
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meaning 

the third submethod is applied 

is there no event v left in store? 
if yes: goto box 42 
if no: goto box 43 

the third submethod is terminated positively 
an event v still in store is selected 
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has said event v occurred? 
if yes: goto box 41 
if no: goto box 45 

does a condition relating to the event v imply that this 
event must occur? 
if yes: goto box 46 
if no: goto box 47 

the third subrnethod is terminated negatively 

is there no further event w not equal to the event v 

left in store? 

if yes: goto box 41 

if no: goto box 48 

an event w still in store is selected 

has said event w occurred? 
if yes: goto box 52 
if no: goto box 50 

does a relationship between the event v and the event 

w imply that at least one of the two events v and w 

must occur? 

if yes: goto box 54 

if no: goto box 51 



13 



EP 0 584 848 A1 



w 



15 



20 



25 



30 



35 



40 



45 



50 
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51 does a relationship between the event w and the event 
v imply that at least one of the two events v and w 
must occur? 

if yes: goto box 54 
if no: goto box 47 

52 does a relationship between the event v and the event 
w imply that, if the event w has occurred, the event v 
must likewise occur? 

if yes: goto box 54 
if no: goto box 53 

53 does a relationship between the event w and the event 
v imply that, if the event w has occurred, the event v 
must likewise occur? 

if yes: goto box 54 
if no: goto box 47 

54 the third submethod is terminated negatively 

The third submethod of the method according to the invention as depicted in the flow chart of Figure 4 
proceeds as follows. The third submethod for determining whether a sequence of allowed events is 
complete (box 40) is applied. First of all. a check is carried out whether there is no event v left in store (box 
41) If that is so, the third submethod is terminated positively (box 42), which means that a complete 
sequence has been found. If, on the other hand, an event v is still in store, said event v is chosen (box 43) 
and a check is carried out whether or not said event v has occurred (box 44). If that is so, a check is again 
carried out whether there is no event v left in store (box 41) etc. If the event v has not occurred, a check is 
carried out whether a condition relating to the event v implies that the latter must occur (box 45), in which 
case the third submethod is terminated negatively (box 46). This means that a sequence of allowed events 
has been found which is not yet complete. If said condition does not imply this, a check is carried out 
whether there is no further event w not equal to the event v left in store (box 47). If that is so, a check is 
again carried out whether no event v is left in store (box 41) etc. If there is still an event w in store, said 
event w is chosen (box 48), whereupon a check is carried out whether the event w has occurred (box 49). If 
th event w has not occurred, a check is carried out whether a relationship between the vent v and the 
ev nt w implies that at least one of the two events v and w must occur (box 50), in which case th third 
submethod is terminated negatively (box 54). In the other case a check is carried out whether a r lationship 
between the event w and the event v implies that at least on of the two events v and w must occur (box 
51). If that is so, the third submethod is t rminated negatively (box 54) and if that is not so, a check is again 
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carried out whether there is no further event w not equal to the event v left in store (box 47) etc. If the event 
w has indeed occurred, a check is carried out whether a relationship between the event v and the event w 
implies that, if the event w has occurred, the event v must likewise occur (box 52), in which case the third 
submethod is terminated negatively (box 54). In the other case, a check is carried out whether a relationship 
5 between the event w and the event v implies that, if the event w has occurred, the event v must likewise 
occur (box 53). If that is so, the third submethod is terminated negatively (box 54), and if that is not so. a 
check is again carried out whether there is no further event w not equal to the event v left in store (box 47), 
etc. 

The third submethod should be called, in Figure 3, just before (above) box 32, and in Figure 2 just 
to before (above) box 22, to ensure that monitoring for the completeness of sequences of allowed events is 
adequate. This prevents the second submethod depicted in Figure 2 and the method depicted in Figure 3 
according to the invention from being applied for an unnecessarily long time. The third submethod therefore 
makes the method according to the invention more efficient. 

Table 1 depicts all the possible relationships between the events a and b (R at >). and the conditions (R aa 
75 and R b b) whether the occurrence of the events a and b is mandatory or not (M = Mandatory, O = Optional 
= non-mandatory). 



20 



30 



35 



40 
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Tabel 1 








No 


Set 




R bb 


R ab 




1 event occurs 








1 


a or b 


0 


0 


1 




0 or 1 event occurs 








2 


0 or a or b 


0 


0 


2 




2 events occur 








3 


(a,b) 


M 


M 


3 


4 


(a,b) or (b,a) 


M 


M 


4 




0 or 2 events occur 








5 


0 or (a,b) 


0 


0 


5 


6 


0 or (a»b) or (b,a) 


0 


0 


6 




1 or 2 events occur 








7 


a or (a f b) 


M 


0 


7 


8 


a or (b,a) 


M 


0 


8 


9 


a or b or (a,b) 


0 


0 


9 


10 


a or (a,b) or (b,a) 


M 


0 


10 


11 


a or b or (a,b) or (b,a) 


0 


0 


11 




0,1 or 2 events occur 








12 


0 or a or (a,b) 


0 


0 


12 


13 


0 or a or (b,a) 


0 


0 


13 


14 


0 or a or b or (a,b) 


0 


0 


14 


15 


0 or a or (a,b) or (b,a) 


0 


0 


15 


16 


0 or a or b or (a,b) or (b,a) 


0 


0 


16 



so Table 1 shows all the possible permutations between the events a and b. If precisely one event occurs 
(No. 1) this means that either the event a or the event b occurs. This is indicated by Set No. 1 "a or b" (R a b 
= 1 ). If precisely two events occur (Nos. 3,4) this means that first the event a and then the event b occurs 
(indicated by Set No. 3 "(a.b)", R a b = 3) or that first one of the two events occurs and then the other 
(indicated by Set No.- 4 "(a,'b) or (b.a)", R a b = 4). H re. the third possible Set "(b,a)" seems to have been 

55 forgotten, but this can be obtained by interchanging the ev nts a and b in S t N (a,b) n and is in fact 
indicated by set No. 3. Table 1 further shows in the case of which possible permutations th occurrence of 
the events a and b is mandatory (M) and when this is not so (Optional = O), this relating to the conditions 
mentioned earlier concerning certain events. In th case of Set No. 1 , both the events a and b are obviously 
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not mandatory (Optional), because only one of the two is permitted to occur, and in the case of Sets Nos. 3 
and 4, both events obviously are indeed mandatory (M) because both then must occur. 

With reference to Table 1. the meaning of some of the boxes depicted in Figures 1 and 4 can be made 
clearer. The following boxes have the following meaning: 

5 

box meaning 



w 



15 



25 



30 



40 



is R ¥V = 3, 5, 7 or 12? (does a relationship between 

Xy 

the event x and the event y imply that the event y is 
not permitted to occur before the event x has 
occurred?); this relates to the relationship of the first 
type 



8 is R v = 1, 2, 8 or 13? (does a relationship between 

xy 



the event x and the event y imply that the event y is 
not permitted to occur after the event x has occurred?); 
this relates to the relationship of the second type 



9 is R yx = 1, 2, 3, 5, 7, 9, 12 or 14? (does a 

35 relationship between the event y and the event x imply 

that the event x is not permitted to precede the event 
y?); this relates to the relationship of the third type 



45 is R vv = M? (does a condition relating to the event v 



45 



50 



55 
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JO 



15 



20 



25 



50 is R vw = 1 , 9 or 1 1 ? (does a relationship between the 
event v and the event w imply that at least one of the 
two events v and w must occur?); this relates to the 
relationship of the fourth type 

51 is R wv = 1, 9 or 11? (does a relationship between the 
event w and the event v imply that at least one of the 
two events v and w must occur?); this relates to the 
relationship of the fifth type 



52 is R vw = 6, 13 or 15? (does a relationship between the 
event v and the event w imply that, if the event w has 

30 occurred, the event v must likewise occur?); this 

relates to the relationship of the sixth type 

35 

53 is R wv = 5 or 6? (does a relationship between the 
event w and the event v imply that, if the event w has 

40 occurred, the event v must likewise occur?); this 

relates to the relationship of the seventh type 

45 An algorithm corresponding to the method according to the invention could, if written in a kind of BASIC 
language, look as follows: 



50 



55 
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METHOD (E) 
for each event k € E 

do occurred(k) : = false 
if THIRD SUBMETHOD 

then print sequence(k) 
for each event k e E 

do if FIRST SUBMETHOD(k) 
then parent(k) : = NIL 

SECOND SUBMETHOD(k) 

FIST SUBMETHOD(m) 
for each event k € E \ {m} 

do if loccurred(k) = false and R km e {3,5,7,12}] 
then return (false) 
if [occurred(k) = true and (R km € {1,2,8,13} or 

R mk e {1,2,3,5,7,9,12,14})] 

then return (false) 
return (true) 

SECOND SUBMETHOD(k) 
occurred(k) : = true 
if THIRD SUBMETHOD 

then print sequence(k) 
for each event m € E 

do if occurred(m) = false and FIRST SUBMETHOD(m) 
then parent(m) : = k 

SECOND SUBMETHOD(m) 
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occurred(k) : = false 



THIRD SUBMETHOD 
for each event k € E 

do if occurred(k) = false 
then if R kk = M 

then return false 
for each event m € E \ {k} 

do if [occurred(m) = false and (R km e 

{1,9,11} or R mk € {1,9,11})] 
then return (false) 
if [occurred(m) = true and (R km € 

{6,13,15} or R mk€ {5,6}>] 
then return (false) 

return (true) 

With reference to the algorithm written in a kind of BASIC language, a test of the following protocol will 
be worked out as an example, using three events r, s and t for which the following holds good: 
35 - R„ = M (i.e. the condition concerning the event r specifies that the occurrence of event r is 
mandatory. 

- Rss = 0 (i.e. the condition concerning the event s specifies that the occurrence of event s is not 
mandatory. 

- R u = M (i.e. the condition concerning the event t specifies that the occurrence of event t is 
40 mandatory. 

- R„ = 10 (i.e. Set No. 10 "r or (r,s) or (s,r) n , in other words the event r will certainly occur, possibly in 
combination with the event s, the sequential order being unimportant. 

- Rrt = 3 (i.e. Set No. 3 w (r,t)", in other words the events r and t both occur, in this sequential order as 
mentioned. 

45 - R IS = 8 (i.e. Set No. 8 "t or (s,t)", in other words the event t will certainly occur, possibly in 
combination with the event s, and if the event s does occur, this happens prior to the occurrence of 
the event t. 

The method according to the invention first of all defines ail the events r, s and t as not occurred (for 
each event k « E do occurred(k): = false). The third submethod is then applied (if THIRD SUBMETHOD 

so then print sequence(k)), which, because the occurrence of the events r and t is mandatory (R rr = R, t = M) 
but the events have still not occurred, indicates that the sequence of allowed events (at this moment 
comprising no events) is not yet complete (for each event k e E do if occurred(k) = false then if R kk = M 
then return false). Hereafter, the first submethod is applied to the event r (for each event k t E do if FIRST 
SUBMETHOD(k)). Because th vents s and t have not yet occurred and the following does not hold good: 

55 Rg, or R tr £ {3.5,7,12}, it is found that the event r is permitted to occur as the first event (do if [occurred(k) 
= false and R km e {3,5,7,12}] then r turn (false), otherwise return (true)), and th second submethod is 
applied to th event r (the par nt of r is nil) in order to find a subsequ nt allowed vent (then parent(k): = 
NIL, SECOND SUBMETHOD (k)). 
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10 



According to the second submethod, first of all the event r is defined as being an event which has 
occurred (occurred(k): = true), and the third submethod is applied (if THIRD SUBMETHOD then print 
sequence(k)), which, because the occurrence of the event t is mandatory (R„ = M) but the event has not 
yet occurred, indicates ttiat the sequence of allowed events (at this moment consisting of the event r) is not 
yet complete (foi each event k c E do if occurred(k) = false then if R kk = M then return false). The first 
submethod is then applied to the event s, using the events s and t as events which have not occurred and 
the event r as an event which has occurred (for each event m € E do if occurred (m) = false and FIRST 
SUBMETHOD(m)). Because the event r has occurred and R rs = 10 and R sr = undefined and the event t 
has not occurred and R ls = 8 it is found that the event s is permitted to occur as the second event after the 
first event r (do if [occurred(k) = false and R km «= {3,5,7.12}] then return (false), if [occurred(k) = true and 
(Rkm < {1,2,8,13} or R mk « {1,2,3,5,7,9,12,14})] then return (false), otherwise return (true)), and the second 
submethod is applied to the event s (the parent of s is r) in order to find a subsequent allowed event (then 
parcnt(m): = k, SECOND SUBMETHOD(m)). 

According to the second submethod, first of all the event s is defined as being an event which has 
is occurred (occurred(k): = true), and the third submethod is applied (if THIRD SUBMETHOD then print 
sequence(k)), which, because the occurrence of the event t is mandatory (R„ = M) but the event has not 
yet occurred, indicates that the sequence of allowed events (at this moment consisting of the events r and 
s) is not yet complete (for each event k * E do if occurred(k) = false then if R kk = M then return false). The 
first submethod is then applied to the event t, using the event t as events which have not occurred and the 
20 events r and s as events which have occurred (for each event m e E do if occurred (m) = false and FIRST 
SUBMETHOD(m)). Because the events r and s have occurred and R r , = 3 and R, s = 8 it is found that the 
event t is permitted to occur as the third event after the first event r and the second event s (do if 
[occurred(k) = true and (R km * {1.2.8,13} or R mk * {1.2.3,5,7.9,12.14})] then return (false), otherwise return 
(true)), and the second submethod is applied to the event t (the parent of t is s) in order to find a 
25 subsequent allowed event (then parent(m): = k. SECOND SUBMETHOD(m)). 

According to the second submethod. first of all the event t is defined as being an event which has 
occurred (occurred(k): = true), and the third submethod is applied (if THIRD SUBMETHOD then print 
sequence (k)}. which, because all events r, s and t have now occurred, indicates that the sequence of 
allowed events, (at this moment consisting of the events r, s and t) is complete, which sequential order of 
30 events is recorded (then print sequence (k)). 

The first submethod is then applied to the event t, using the events s and t as events which have not 
occurred and the event r as an event which has occurred (for each event m e E do if occurred (m) = false 
and FIRST SUBMETHOD(m)). Because the event r has occurred and R rI = 3 and R lr = undefined and the 
event s has not occurred and R st = undefined it is found that the event t is permitted to occur as the 
second event after the first event r (do if [occurred(k) = false and R km « {3,5,7,12}] then return (false), if 
[occurred(k) = true and <R km e {1,2.8,13} or R mk « {1,2,3,5,7,9,12,14})] then return (false), otherwise return 
(true)), and the second submethod. is applied to the event t (the parent of t is r) in order to find a 
subsequent allowed event (then parent(m): = k, SECOND SUBMETHOD(m)). 

According to the second submethod, first of all the event t is defined as being an event which has 
40 occurred (occurred(k): = true), and the third submethod is applied (if THIRD SUBMETHOD then print 
sequence(k)), which, because the occurrence of the events r and t is mandatory (R rr = R tt - M) and the 
events have occurred, and because the event s has not occurred while the following holds good: R rs = 10, 
R rt = 3 and R ts = 8, indicates that the sequence of allowed events (at this moment consisting of the events 
r and t) is complete, which sequential order of events is recorded (then print sequence(k)). 

Thereafter, the first submethod is applied to the event s (for each event k e E do if FIRST 
SUBMETHOD(k)). Because the events r and t have not yet occurred (the second submethod terminates 
with the redefinition of the event in question as an event which has not occurred, occurred(k): = false) and 
the following does not hold good: R^ or R ts « {3,5,7,12}, it is found that the event s is permitted to occur as 
the first event (do if [occurred(k) = false and R km < {3,5,7,12}] then return (false), otherwise return (true)), 
so and the second submethod is applied to the event s (the parent of s is nil) in order to find a subsequent 
allowed event (then parent(k): = NIL, SECOND SUBMETHOD(k)). According to the second submethod, first 
of all the event s is defined as being an event which has occurred (occurred(k): = true), and the third 
submethod is applied (if THIRD SUBMETHOD then print sequence(k)), which, because the occurrence of 
the ev nts r and t is mandatory (R„ = R t , = M) but the event has not yet occurred, indicates that the 
55 sequence of allowed events (at this moment consisting of the event s) is not yet complete (for each event k 
€ E do if occurred(k) = false then if R kk = M then return false). The first submethod is then applied to the 
event r, using the events r and t as events which have not occurred and the vent s as an vent which has 
occurred (for each event m « E do if occurred (m) = false and FIRST SUBMETHOD(m)). Because the event 
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s has occurred and R rs = 10 and R sr = undefined and the event t has not occurred and R, s = 8 it is found 
that the event r is permitted to occur as the second event after the first event s (do if [occurred(k) = false 
arid R km t {3,5,7,12}] then return (false), if [occurred(k) = true and (R km < {1,2.8,13} or R mk t 
{1,2,3,5.7,9,12,14})] then return (false), otherwise return (true)), and the second submethod is applied to the 
b tivtMil r (the parent of r is s) in order to find a subsequent allowed event (then parent(m): = k, SECOND 
SUBMETHOD(m)). 

According to the second submethod, first of all the event r is defined as being an event which has 
occurred (occurred(k): = true), and the third submethod is applied (if THIRD SUBMETHOD then print 
sequence(k)), which, because the occurrence of the event t is mandatory (R„ = M) but the event has not 

to yet occurred, indicates that the sequence of allowed events (at this moment consisting of the events s and 
r) is not yet complete (for each event k € E do if occurred(k) = false then if R kk = M then return false). The 
first submethod is then applied to the event t, using the event t as events which have not occurred and the 
events s and r as events which have occurred (for each event m « E do if occurred (m) = false and FIRST 
SUBMETHOD(m)). Because the events s and r have occurred and R r , = 3 and R, r = undefined and R s1 = 

is undefined and R, s = 8 it is found that the event t is permitted to occur as the third event after the first event 
s and the second event r (do if [occurred(k) = true and (R km < {1,2,8,13} or R mk c {1,2,3,5,7,9,12,14})] then 
return (false), otherwise return (true)), and the second submethod is applied to the event t (the parent of t is 
r) in order to find a subsequent allowed event (then parent(m): = k, SECOND SUBMETHOD(m)). 

According to the second submethod, first of all the event t is defined as being an event which has 

20 occurred (occurred(k): = true), and the third submethod is applied (if THIRD SUBMETHOD then print 
sequence (k)), which, because all events s, r and t have now occurred, indicates that the sequence of 
allowed events (at this moment consisting of the events s, r and t) is complete, which sequential order of 
events is recorded (then print sequence (k)). 

The first submethod is then applied to the event t, with the events r and t as events which have not 

25 occurred and the event s as an event which has occurred (for each event m t E do if occurred(m) = false 
and FIRST SUBMETHOD(m)). Because the event r has not occurred and R r , = 3 it is found that the event t 
is NOT permitted as the second event after the first event s (do if [occurred(k) = false and R km € 
{3,5,7,12}] then return (false), otherwise return (true)) and the second submethod is NOT proceeded with. 
Thereafter, the first submethod is applied to the event t (for each event k « E do if FIRST 

30 SUBMETHOD(k)). Because the events r and s have not yet occurred (the second submethod terminates 
with the redefinition of the event in question as an event which has not occurred, occurred(k): = false) and 
Rn < {3,5,7,12} holds good, it is found that the event t is NOT permitted to occur as the first event (do if 
[occurred(k) = false and R km e {3,5,7,12}] then return (false), otherwise return (true)) and the second 
submethod is NOT proceeded with. 

35 Thus the algorithm is used to find three possible sequences of allowed events for the protocol 
mentioned: (r.s.t), (r.t) and (s.r.t). Based on the conditions and relationships associated with said protocol, 
these three sequences can be derived in a simple manner in one's head. If the protocol becomes more 
complex, however, (for example containing ten events with ten conditions and fifteen relationships), such 
sequences can no longer be derived from one's head and/or by writing them out and the algorithm (the 

40 method according to the invention) provides the valid solution in an efficient manner. 

An algorithm of this type can be stored as software in a PC in a manner which is straightforward to 
those skilled in the art. The system for application of the method is indeed, in the first instance, meant to 
refer to a PC or microprocessing means. The means for storing event codes, status codes, relationship 
codes, combination codes and occurrence codes are then formed by the memory of the PC, and the 

45 associated microprocessor is designed for performing analyses of first, second and third types (correspond- 
ing to the first second and third submethod) by means of instructions stored as software which call up, in a 
particular sequential order, the contents of the means, possibly change and compare them and again store 
them changed or unchanged. 

It would, however, also be possible to implement the system specially for application of this method 

so according to the invention, the means for storing (memory ICs) being coupled to a computing device via 
which the contents of the means are loaded, whereupon the computing device interrogates these contents 
in a particular sequential order, possibly changes and compares them and then stores them again changed 
or unchanged. 

55 Claims 

1. Method for testing a protocol in which events occur which have defined relationships with one another, 
characterised in that 
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- the method comprises a first submethod for determining whether an event y is permitted to occur 
by 

- checking, if a further event x has not occurred, whether a relationship between the event x and 
the event y implies that the event y is not permitted to occur before the event x has occurred, 

5 in which case the combination is not allowed, 

- checking, if a further event x has occurred, whether a relationship between the event x and the 
event y implies that the event y is not permitted to occur after the event x has occurred and 
whether a relationship between the event y and the event x implies that the event x is not 
permitted to precede the event y, in which cases the combination is not allowed, 

10 . establishing, in all other cases, that the combination is allowed and repeating the first 

submethod in order to determine whether the event y is permitted to occur in combination with 
another further event, 

. the method comprises a second submethod for finding a subsequent allowed event q in the case 
of an event p by 

J5 . defining the event p as being an event which has occurred and appending it to a sequence of 

allowed events which have occurred, 

- repeating, if the event q has already occurred, the second submethod in order to find another 
subsequent allowed event, 

- checking, if the event q has not occurred, by applying the first submethod whether the event q 
2Q is permitted to occur in combination with the event p, and by 

- appending, in the case of an allowed combination, the event q to a sequence of allowed 
events which have occurred and repeating the second submethod in order to find a 
subsequent allowed event in the case of the event q, 

- repeating, in the case of a non-allowed combination, the second submethod in order to find 
2 5 another subsequent allowed event in the case of the event p. and 

- redefining the event p as being an event which has not occurred and removing it from the 
sequence of allowed events which have occurred. 

- the method finds all possible sequences of allowed events by 

- applying the first submethod to every possible first event, and 

30 - applying the second submethod to all possible first events found. 

2. Method according to Claim 1, characterised in that the method comprises a third submethod for 
determining whether a sequence of allowed events is complete, a condition specifying, of each event, 
whether the occurrence of this event is or is not mandatory, by 

3 5 - checking, if an arbitrarily chosen event v has not occurred, whether a condition relating to the 

event v implies that the event v must occur, in which case the sequence is not complete, and in 
the other case, if the arbitrarily chosen event v has not occurred, by 

- checking, if a further event w has not occurred, whether a relationship between the event v and 
the event w and a relationship between the event w and the event v imply that at least one of 

40 the two events v and w must occur, in which case the sequence is not complete, 

- checking, if the further event w has occurred, whether a relationship between the event v and 
the event w and a relationship between the event w and the event v imply that, if the event w 
has occurred, the event v must occur likewise, in which case the sequence is not complete, 
and 

45 t - repeating the third submethod with another further event, and 

- repeating, if the arbitrarily chosen event v has occurred, the third submethod with another 
arbitrarily chosen event in order to determine whether a sequence of allowed events is complete. 

3. System for applying the method according to Claim 1, characterised in that the system is provided with 
so means for storing 

- at least one event code which is representative for an event which may occur, 

- at least one status code which is representative for a status of this event, 

- at least one relationship code which is representative for a relationship between this event and 
another event, and 

55 . a t least one combination code which is representative for the allowedness of a combination of 

vents, 

in which the system, for determining whether an vent y is permitted to occur, is designed for an 
analysis of a first type by 
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- disallowing, in the case of a status code related to a further event x in one sense and a 
relationship code related to the events x and y of a first type, the combination and assigning a 
negative combination code, 

- disallowing, in the case of a status code related to a further event x in another sense and a 
5 relationship code related to the events x and y of a second type and a relationship code related 

to the events y and x of a third type, the combination and assigning a negative combination code, 

- allowing, in ail other cases, the combination and assigning a positive combination code and 
repeating the analysis of a first type for determining whether the event y is permitted to occur in 
combination with another further event, 

;o in which the system, for finding a subsequent allowed event q in the case of an event p, is designed for 
an analysis of a second type by 

- assigning a status code in another sense to the event p and appending the event p to a sequence 
of allowed events which have occurred, 

- repeating, in the case of a status code in another sense related to event q, the analysis of a 
75 second type for finding another subsequent allowed event, 

- performing, in the case of a status code in one sense related to event q, an analysis of a first 
type for determining whether the event q is permitted to occur in combination with the event p 
and by 

- appending, in the case of a positive combination code, the event q to a sequence of allowed 
20 events which have occurred and performing an analysis of a second type for finding a 

subsequent allowed event in the case of the event q, and 

- performing, in the case of a negative combination code, an analysis of a second type for 
finding another subsequent allowed event in the case of the event p, 

- assigning a status code in one sense to the event p and removing the event p from a sequence 
25 of allowed events which have occurred. 

in which the system, for finding all possible sequences of allowed events, is designed for 

- performing an analysis of a first type for every possible first event, 

- performing an analysis of a second type for ail possible first events found. 

30 4. System according to Claim 3, characterised in that the system is provided with means for storing at 
least one occurrence code which is representative for the mandatory occurrence of an event, which 
system, for determining whether a sequence of allowed events is complete, is designed for an analysis 
of a third type by 

- establishing, in the case of a status code, related to an arbitrarily chosen event v, in one sense 
35 and a positive occurrence code related to the arbitrarily chosen event v, that a sequence is 

incomplete and by, in the case of a negative occurrence code related to the arbitrarily chosen 
event v and of a status code, related to the arbitrarily chosen event v, in one sense 
• establishing, in the case of a status code, related to a further event w, in one sense and a 
relationship code, related to the events v and w, of a fourth type and a relationship code, 
40 related to the events w and v, of a fifth type, that a sequence is incomplete, 

- establishing, in the case of a status code, related to a further event w, in another sense and a 
relationship code, related to the events v and w, of a sixth type and a relationship code, related 
to the events w and v, of a seventh type, that a sequence is incomplete, 

- subsequently performing an analysis of a third type with another further event w, and 

46 - performing, in the case of a status code, related to an arbitrarily chosen event v, in another sense, 

an analysis of a third type with another arbitrarily chosen event to determine whether a sequence 
of allowed events is complete. 



so 
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